With the development of electronic technologies, electronic medical systems have been widely employed in modern medical organizations so as to maintain and manage the individual information and health records (such as the case history, the testing report, and the like) of users (for example, patients). However, electronic records are vulnerable to theft and dissemination. Accordingly, the security issue of modern electronic medical systems is a matter of great concern.
To improve the security of electronic medical systems, two methods of protecting user privacy have been proposed: anonymization and pseudonymization. The purpose of anonymization is to remove the association between the real identity of a user and his or her health records. In other words, in an anonymization method, no individual information about the user is recorded, and only the health records are kept. In such an anonymization method, the user cannot be traced via the health records, though user privacy may be protected securely. The pseudonymization method has been developed on the basis of the anonymization method. In the pseudonymization method, the association between the real identity of a user and his health records has been removed, and the relationship of correspondence is established between the user's health records and one or more of his pseudonyms. Accordingly, the pseudonymization method provides protection of the user's individual information, as well as traceability of his health records.
FIG. 1 illustrates a current pseudonymization mechanism developed by the Healthcare Information Technology Standards Panel (HITSP). As shown in FIG. 1, when a user U100 goes to hospital, he first provides a user identity IDuser identifying his real identity to a medical system D110 of the hospital in step S110. In step S120, the medical system D110 sends the IDuser to a Person Identifier Cross-Reference (PIX) manager D120. In step S130, the PIX manager D120 stores the IDuser and requests a pseudonym server D140 for pseudonym generation so as to assign a pseudonym to the user in step S140. In step S150, the pseudonym server D140 generates a pseudonym Ppseu for the user in response to the request, and in step S160, the pseudonym server D140 returns the generated pseudonym Ppseu to the PIX manager D120. In step S170, the PIX manager D120 stores the received pseudonym Ppseu in a one-to-one association with the IDuser and, in step S180, returns a pseudonym certificate containing the pseudonym Ppseu to the medical system D110. Then, the medical system D110 of the hospital registers the pseudonym certificate in step S190, and returns it to the user U100 in step S195. In this way, the user U100 may be diagnosed or treated with the assigned pseudonym in the hospital, and his health records will be recorded in the name of the pseudonym. Alternatively, the hospital may obtain the real identity of the user from the PIX manager D120 by using this pseudonym certificate as desired, so that traceability may be achieved.
Unfortunately, the current pseudonymization method as shown in FIG. 1 has some drawbacks.
First, in consideration of security, privacy or the like, or for the reason that a user may have lost a previously generated pseudonym, he may request generation of a new pseudonym every time he goes to the hospital, or even request generation of multiple different new pseudonyms so that diagnosis and/or treatment may be performed for various diseases in the same hospital. In this case, the pseudonym server D140 in FIG. 1 has to generate pseudonyms for the user frequently, which leads to a heavy workload on the pseudonym server. Meanwhile, the PIX manager has to save the relationships of correspondence between the real identity of a user and a large number of pseudonyms. Therefore, the PIM has to be provided with a mass storage database, which leads to an increase in cost of the server.
Secondly, the provision of pseudonymization services is generally distinctly regional, that is, a local pseudonym server and an identity manager can only provide pseudonymization services to medical systems in local hospitals within their service coverage or medical systems employing the same pseudonymization service mechanism. In other words, if a medical system generates a pseudonym for a user, medical systems in different regions or with different pseudonymization mechanisms cannot identify the pseudonym for the same user. Every time the user moves from one region to another new region, he must therefore disclose his real identity to the PIM in this new region before obtaining a pseudonym valid in this new region, and then he uses this pseudonym to be treated at the hospital. This causes much inconvenience to the users.
Thirdly, in some trust-based cases, a user is only willing to disclose his real identity to his own trusted local PIM, rather than to a PIM in another strange region. In this respect, the current pseudonymization method can only be applied in a very limited region.
There is, therefore, a need to provide an improved method and apparatus for pseudonym generation and authentication so as to assist the user in enjoying a cross-regional medical service easily and securely.